Argo CD 单点登录

用 Casdoor 配置 Argo CD

1. 1

   在 Casdoor 中注册 Argo CD

   在 Casdoor 控制台打开 应用，为 Argo CD 添加一个应用，在它的 OIDC/OAuth 标签页复制 客户端ID 和 客户端密钥。把下面的地址加到 重定向URLs：

   • https://argocd.example.com/auth/callback
   • http://localhost:8085/auth/callback

   The second URL is for argocd login --sso from the CLI. 要用群组的话，先在应用所属的组织里创建群组（例如 argocd-admins）并加入用户，再在同一个标签页把 Token 中的群组格式 设成 Name，这样令牌里是 argocd-admins，而不是 <组织>/argocd-admins。

2. 2

   Store the client secret

   Put the client secret in the argocd-secret Secret, where oidc.config can reference it.

   kubectl -n argocd patch secret argocd-secret \
     --patch='{"stringData": {"oidc.casdoor.clientSecret": "<client secret>"}}'

3. 3

   Configure OIDC in argocd-cm

   Add Casdoor to the argocd-cm ConfigMap. Casdoor puts the user's groups in the ID token, which is where Argo CD reads them.

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: argocd-cm
     namespace: argocd
   data:
     url: https://argocd.example.com
     oidc.config: |
       name: Casdoor
       issuer: https://auth.example.com
       clientID: <client ID>
       clientSecret: $oidc.casdoor.clientSecret
       requestedScopes: ["openid", "profile", "email"]
       enablePKCEAuthentication: true

4. 4

   Grant permissions by group

   Map Casdoor groups to Argo CD roles in argocd-rbac-cm. Here members of argocd-admins get full access and everyone else can only look.

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: argocd-rbac-cm
     namespace: argocd
   data:
     policy.default: role:readonly
     policy.csv: |
       g, argocd-admins, role:admin
     scopes: "[groups]"

5. 5

   Sign in

   The Argo CD login page now has a Log in via Casdoor button, and argocd login argocd.example.com --sso opens Casdoor in the browser.

Argo CD 的设置取自它的官方文档（核对于 2026年10月：Argo CD user management）；另见Casdoor 文档。Argo CD 是其所有者的商标。